allow to disable user preferences by permission (#895)

src/Voter/UserVoter.php

@@ -83,13 +83,13 @@ class UserVoter extends AbstractVoter
             // used in templates and ProfileController
             case self::VIEW:
             case self::EDIT:
-            case self::PREFERENCES:
                 // always allow the user to edit these own settings
                 if ($subject->getId() === $user->getId()) {
                     return true;
                 }
                 // no break on purpose
 
+            case self::PREFERENCES:
             case self::PASSWORD:
             case self::API_TOKEN:
             case self::ROLES: